CVE-2025-64287: Alloggio Hotel Booking Path Traversal Flaw

CVE-2025-64287 Overview

CVE-2025-64287 is a Local File Inclusion (LFI) vulnerability affecting the Edge-Themes Alloggio - Hotel Booking WordPress theme. The flaw stems from improper control of filename parameters used in PHP include or require statements, classified under [CWE-98]. Attackers can force the application to load arbitrary local PHP files, leading to source code disclosure, sensitive data exposure, or code execution when combined with file upload primitives. The vulnerability affects all versions of Alloggio - Hotel Booking up to and including version 1.8.

Critical Impact
Unauthenticated network attackers can include local PHP files, potentially achieving remote code execution on affected WordPress installations.

Affected Products

Edge-Themes Alloggio - Hotel Booking WordPress theme
All versions from n/a through 1.8
WordPress sites running the vulnerable theme

Discovery Timeline

2025-11-06 - CVE-2025-64287 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64287

Vulnerability Analysis

The Alloggio - Hotel Booking theme accepts user-controlled input that flows into a PHP file inclusion statement without sufficient validation. This design flaw allows an attacker to manipulate the filename argument passed to include, require, include_once, or require_once. The result is a Local File Inclusion vector where the PHP interpreter loads and executes files present on the server filesystem. Successful exploitation compromises confidentiality, integrity, and availability of the target WordPress installation.

Root Cause

The root cause is improper control of the filename parameter used in a PHP include or require statement [CWE-98]. The theme fails to whitelist permitted files or sanitize path traversal sequences such as ../ before passing input to the inclusion function. This category of flaw commonly appears when template selection, page routing, or dynamic component loading uses raw request parameters as filesystem paths.

Attack Vector

The attack vector is network-based and does not require authentication or user interaction. An attacker crafts an HTTP request containing a manipulated parameter that references a local file path. The PHP runtime resolves the path and includes the target file. Attackers can chain this with log poisoning, session file inclusion, or uploaded media files to escalate LFI into remote code execution.

The vulnerability manifests in the theme's file inclusion logic. See the Patchstack WordPress Vulnerability Report for advisory-level technical details.

Detection Methods for CVE-2025-64287

Indicators of Compromise

HTTP requests containing path traversal sequences (../, ..%2f, %2e%2e/) targeting Alloggio theme endpoints
Access log entries referencing sensitive paths such as /etc/passwd, wp-config.php, or PHP session files
Unexpected PHP file execution originating from the theme directory /wp-content/themes/alloggio/
Anomalous outbound connections from the web server following theme requests

Detection Strategies

Inspect web server access logs for query parameters containing filesystem paths or encoded traversal patterns
Deploy web application firewall rules matching LFI signatures on requests to Alloggio theme URIs
Correlate php process activity with HTTP requests that include filename-like parameters
Alert on reads of sensitive configuration files by the web server user

Monitoring Recommendations

Enable PHP open_basedir logging to capture out-of-scope file access attempts
Monitor WordPress theme directories for integrity changes and unexpected new PHP files
Track authentication-less requests that trigger PHP inclusion paths in real time
Aggregate WordPress and web server telemetry into a centralized SIEM for correlation

How to Mitigate CVE-2025-64287

Immediate Actions Required

Identify all WordPress sites running the Alloggio - Hotel Booking theme version 1.8 or earlier
Disable or switch away from the vulnerable theme until a patched release is applied
Restrict web server file access using open_basedir and least-privilege filesystem permissions
Deploy WAF rules blocking path traversal payloads targeting theme parameters

Patch Information

Refer to the Patchstack advisory for vendor patch status. At the time of publication, the vulnerability affects versions through 1.8. Site administrators should upgrade to a fixed version once released by Edge-Themes.

Workarounds

Configure PHP open_basedir to restrict includes to the WordPress installation directory
Set allow_url_include=Off and allow_url_fopen=Off in php.ini to block remote inclusion escalation
Apply virtual patching via WAF signatures that reject requests with directory traversal encodings
Remove the theme entirely if it is not actively required for the site

bash

# Configuration example: harden PHP against LFI exploitation
# /etc/php/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"

# Nginx location rule to block obvious traversal attempts
# /etc/nginx/conf.d/wordpress.conf
location ~* /wp-content/themes/alloggio/ {
    if ($args ~* "(\.\./|\.\.%2f|%2e%2e)") {
        return 403;
    }
}